CVE-2026-100756

The Audio/Video: Playback component is vulnerable to incorrect boundary conditions . An attacker could trigger a heap buffer overflow by inducing a user to open an email with a size greater than or equal to 2GB . Impacted products include Firefox (versions 157, ESR 115.42, 140.17, and 153.4) and ...

CVE-2026-4724

CVE-2026-4724 affects Mozilla Firefox and Mozilla Thunderbird. The root cause is undefined behavior in the Audio/Video component, leading to potential security bypass or other impacts as described in the connected records. The vulnerability is reported across multiple sources (CNVD EUVD entries) ...

CVE-2026-4728

CVE-2026-4728 : A spoofing issue in the Privacy: Anti-Tracking component is documented for Mozilla Firefox and Mozilla Thunderbird. The connected documents consistently state the vulnerability and that it has been fixed in Firefox 149 and Thunderbird 149 . No additional technical details (root ca...

CVE-2026-92020

The Graphics: WebRender component in Mozilla Firefox and Thunderbird is vulnerable to privilege escalation due to incorrect boundary conditions. This issue affects several versions, including Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird 156 , Thunderbird...

CVE-2026-92022

A use-after-free vulnerability exists in the DOM: HTML Parser component of Mozilla Firefox and Thunderbird . This flaw can be triggered during the parsing of HTML content. The issue has been addressed in several versions, including Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox E...

CVE-2026-92023

A Use-after-free vulnerability exists in the XML component of the Mozilla Firefox and Thunderbird applications. This flaw could potentially allow an attacker to cause a crash or achieve arbitrary code execution. The issue has been addressed in the following versions: Firefox 156 , Firefox ESR 115...

CVE-2026-92026

A use-after-free vulnerability exists in the Networking component of the Mozilla Firefox and Thunderbird applications. This issue is addressed in the following versions: Firefox 156 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird 156 , Thunderbird 140.16 , and Thunderbird 153.3 . No specif...

CVE-2026-92069

This vulnerability involves a spoofing issue within the DOM: Navigation component . The flaw has been addressed in the following versions: Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While multiple connected documents list this CVE, they do not provide specific tec...

CVE-2026-92073

CVE-2026-92073 is a privilege escalation vulnerability within the Enterprise Policies component of the Mozilla Firefox browser. This issue was addressed in Firefox version 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While various security advisories and package updates (su...

CVE-2026-92011

The Graphics: CanvasWebGL component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to privilege escalation due to incorrect boundary conditions . This security flaw affects multiple versions, including Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 1...

CVE-2026-100787

A sandbox escape vulnerability exists in the XUL component affecting Mozilla Firefox and Thunderbird . The flaw allows for a sandbox escape, and the issue has been addressed in Firefox ESR 153.4 , Thunderbird 157 , Thunderbird 153.4 , and Firefox 157 . Exploitation details are not provided in the...

CVE-2026-12330

The Internationalization component in Mozilla Firefox and Mozilla Thunderbird contains a vulnerability due to incorrect boundary conditions . This issue affects various versions, including Firefox ESR 115.37 , Firefox ESR 140.12 , and Thunderbird 140.12 . Remediation is available in the specified...

CVE-2026-6781

A Denial-of-Service (DoS) vulnerability exists in the Audio/Video: Playback component of Mozilla Firefox and Mozilla Thunderbird . The root cause is an uncontrolled resource consumption issue within the playback functions, which could allow an attacker to trigger a service failure or service inte...

CVE-2026-92021

A use-after-free vulnerability exists in the JavaScript Engine: JIT component of the Firefox browser and Thunderbird mail client. This flaw was addressed in Firefox ESR 140.16 and Thunderbird 140.16 . No specific exploit details or in-the-wild exploitation information are provided in the documents.

CVE-2026-92076

CVE-2026-92076 is a vulnerability in the Networking component of Firefox and Thunderbird caused by incorrect boundary conditions . The issue has been addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the initial description notes the Networking compone...

CVE-2025-11721

CVE-2025-11721 describes a memory safety bug in Firefox 143 and Thunderbird 143, with evidence of memory corruption and potential arbitrary-code execution. Affected versions include Firefox < 144 and Thunderbird

CVE-2025-14332

CVE-2025-14332 is a memory-safety bug found in Firefox 145 and Thunderbird 145, with potential for arbitrary code execution. It affects Firefox and Thunderbird versions older than 146. The connected documents indicate remediation by upgrading to Firefox/Thunderbird 146. If upgrading is not possib...

CVE-2026-0889

The Mozilla Firefox web browser and Mozilla Thunderbird email client are vulnerable to a Denial-of-Service (DoS) attack. The root cause is an error in the DOM: Service Workers component involving uncontrolled resource consumption . A malicious actor can exploit this flaw to cause the browser to c...

CVE-2026-5735

CVE-2026-5735 affects Mozilla Firefox and Thunderbird 149.0.1, with memory safety bugs that can cause memory corruption and, per sources, could be exploited to run arbitrary code. Affected components are within Firefox/Thunderbird rendering and memory management; the issue has been fixed in Firef...

CVE-2026-92072

This vulnerability exists in the Safe Browsing component due to incorrect boundary conditions . The flaw affects Mozilla Firefox and Thunderbird software. Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . Exploitation details are not provided ...

CVE-2026-84640

Mozilla Thunderbird is vulnerable to a one-byte read past the end of a buffer caused by a maliciously constructed mail header. This issue is identified as a mail parser vulnerability. The flaw has been remediated in Thunderbird versions 155 , 140.15 , and 153.2 . Specific distribution updates, su...

CVE-2026-92039

A mitigation bypass exists in the DOM: Notifications component of the Mozilla Firefox browser and Thunderbird. This vulnerability was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . No specific details regarding the root cause or exploit vectors are provid...

CVE-2026-92077

A Denial-of-Service (DoS) vulnerability exists in the SVG component of the Mozilla Firefox and Thunderbird browsers. This vulnerability is confirmed to affect the SVG component and was addressed in several security updates. Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird...

CVE-2025-11713

Mozilla products, including Firefox , Firefox ESR , and Thunderbird , are vulnerable to a code execution flaw due to insufficient escaping in the "Copy as cURL" feature. On Windows , this issue could trick users into executing unexpected code. The vulnerability is mitigated by updating to Firefox...

CVE-2026-100781

A sandbox escape vulnerability exists in the Graphics: WebRender component due to incorrect boundary conditions . This issue affects multiple Mozilla products, including Firefox ESR 115.42 , Firefox ESR 140.17 , Firefox 157 , Thunderbird 140.17 , Thunderbird 153.4 , and Thunderbird 157 . The vuln...

CVE-2026-92015

A privilege escalation vulnerability exists in the WebExtensions component of the Mozilla Firefox and Thunderbird browsers. This flaw was addressed in the following releases: Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird 156 , Thunderbird 140.16 , and Thu...

CVE-2026-92029

A use-after-free vulnerability exists in the SVG component of Mozilla Firefox and Mozilla Thunderbird . This flaw can potentially lead to memory corruption or execution flow issues. Affected versions include various releases, and the vulnerability has been addressed in Firefox 156 , Firefox ESR 1...

CVE-2026-92078

A Denial-of-Service vulnerability exists in the Security component of Mozilla Firefox and Thunderbird . This issue has been addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . No specific root cause or exploit information is provided in the documentation.

CVE-2025-11715

Memory safety bugs exist in Firefox ESR 140.3 , Thunderbird ESR 140.3 , Firefox 143 , and Thunderbird 143 . These vulnerabilities involve memory corruption and could potentially be exploited to execute arbitrary code . The issues have been addressed in Firefox 144 , Firefox ESR 140.4 , Thunderbir...

CVE-2026-92239

A maliciously constructed IMAP line in Mozilla Thunderbird could cause an out-of-bounds buffer read . This vulnerability impacts versions prior to 156 , 140.16 , and 153.3 . Remediation is available in Thunderbird versions 156 , 140.16 , and 153.3 . Specific distribution packages, such as Debian ...

CVE-2026-96869

The Networking component in Firefox is subject to an information disclosure vulnerability (CVE-2026-96869 ). This issue was reported by Carlo Di Dato and has a moderate impact. The vulnerability has been addressed in Firefox ESR 153.4 , Firefox 157 , and Firefox ESR 140.17 . No specific exploit d...

CVE-2026-0888

The Mozilla Firefox web browser and Mozilla Thunderbird email client are affected by an information disclosure vulnerability within the XML component . This flaw allows a malicious actor to potentially gain access to confidential data . The vulnerability has been addressed in Firefox 147 and Thun...

CVE-2026-4371

The Mozilla Thunderbird email client is vulnerable to an out-of-bounds read in the IMAP parsing component. A malicious mail server can send malformed strings with negative lengths, triggering the parser to read memory outside the buffer. If a mail server or connection is compromised, an attacker ...

CVE-2026-92040

A use-after-free vulnerability exists in the JavaScript: WebAssembly component of Mozilla Firefox and Thunderbird . This flaw was addressed in versions 156 of both products. While the vulnerability is confirmed, specific details regarding the root cause, technical impact, or exploit availability ...

CVE-2026-100782

The Firefox browser is affected by a privilege escalation vulnerability (CVE-2026-100782 ) caused by incorrect boundary conditions in the Graphics component . This flaw allows for unauthorized privilege escalation and has been addressed in the following versions: Firefox ESR 153.4 , Firefox 157 ,...

CVE-2026-100818

The Firefox browser is affected by a sandbox escape vulnerability caused by a use-after-free in the Widget: Gtk component. This vulnerability was addressed in Firefox ESR 153.4 , Firefox 157 , and Firefox ESR 140.17 . No specific exploit details or in-the-wild exploitation information are provide...

CVE-2026-92016

A use-after-free vulnerability exists in the Disability Access APIs component of Mozilla Firefox and Thunderbird. This flaw impacts multiple versions, including Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. The vulnerability is cha...

CVE-2026-92025

A use-after-free vulnerability exists in the DOM: Navigation component of the Mozilla Firefox and Thunderbird browsers. This security flaw impacts several versions of the software. Remediation is available in Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird ...

CVE-2026-92068

A site isolation issue exists in the Reader Mode component of the Mozilla Firefox and Thunderbird browsers. This vulnerability was addressed in Firefox versions 156 and ESR 153.3, and Thunderbird versions 156 and 153.3. No specific exploit details or in-the-wild exploitation information are provi...

CVE-2026-100810

An issue exists within the DevTools component in Mozilla Firefox and Thunderbird . This vulnerability affects versions prior to 157 . The impact of this vulnerability is rated as CRITICAL with a CVSS 3.1 score of 9.8 , potentially leading to high confidentiality, integrity, and availability impac...

CVE-2026-92031

CVE-2026-92031 is an information disclosure vulnerability affecting the Graphics: ImageLib component in the Mozilla Firefox and Mozilla Thunderbird applications. The flaw allows for the unauthorized disclosure of information. Remediation is available in Firefox 156 , Firefox ESR 140.16 , Firefox ...

CVE-2025-14326

CVE-2025-14326 is a use-after-free in the Audio/Video: GMP component affecting Firefox < 146 and Thunderbird

CVE-2026-100785

A use-after-free vulnerability exists in the DOM: Core & HTML component of the Firefox browser. This flaw was addressed in various releases, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . While the specific root cause is not detailed beyond the memory sa...

CVE-2026-92063

A Denial-of-service vulnerability exists in the Audio/Video component of Firefox and Thunderbird . This issue has been addressed in Firefox 156 and Thunderbird 156 . While specific technical root causes are not detailed in the provided documents, the vulnerability is confirmed to impact these spe...

CVE-2026-92240

Mozilla Thunderbird is vulnerable to an out-of-bounds read in its IMAP response parser. A malicious or compromised IMAP server can trigger this by sending an untagged ' ID' * response, which results in an application crash. The affected parsing path is reachable before authentication . Remediatio...

CVE-2026-100816

A site isolation issue exists in the DOM: Networking component of Mozilla products. This vulnerability affects Firefox ESR 153.4 , Thunderbird 157 , Thunderbird 153.4 , and Firefox 157 . The issue has been addressed in these specific versions. No specific exploit details or in-the-wild exploitati...

CVE-2026-92014

Mozilla Firefox and Thunderbird are affected by a privilege escalation vulnerability caused by incorrect boundary conditions within the Graphics component . This issue is addressed in Firefox ESR 115.41 , Firefox ESR 140.16 , and Thunderbird 140.16 . No specific exploit details or in-the-wild exp...

CVE-2026-100820

A privilege escalation vulnerability exists in the Address Bar component of the Firefox web browser. This flaw allows for elevated privileges during use. The issue has been addressed in Firefox ESR 153.4 , Firefox 157 , and Firefox ESR 140.17 . No specific exploit details or in-the-wild exploitat...

CVE-2026-100780

A use-after-free vulnerability exists in the DOM: Core & HTML component of the Firefox browser. This flaw was addressed in several versions, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . While the specific technical root cause is not detailed beyond the...

CVE-2026-100786

A sandbox escape vulnerability exists in the Graphics component of the Firefox browser due to a use-after-free condition. This flaw was addressed in multiple releases, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . No specific exploit details or external...